PspSetupReservedUserMappings

INT64 __fastcall PspSetupReservedUserMappings(_EPROCESS *a1, _KAPC_STATE *a2, _QWORD *a3){
  int v5; 
  NTSTATUS VirtualMemory; 
  unsigned __int64 v8; 
  __int64 v9; 
  UINT64 AllocationType; 
  UINT64 Protect; 
  ULONG_PTR RegionSize; 
  PVOID BaseAddress; 
  BaseAddress = 0i64;
  RegionSize = 0i64;
  v5 = *(_DWORD *)(a3[26] + 8i64) & 0x60;
  if( !v5 && !a3[32] )
    return 0i64;
  VirtualMemory = 0;
  KiStackAttachProcess((_KPROCESS *)a1, 0i64, a2);
  if( !v5 )
    goto LABEL_10;
  BaseAddress = (PVOID)4;
  if( v5 == 32 )
  {
    RegionSize = 1048320i64;
  }
  else if( v5 == 64 )
  {
    RegionSize = 16776960i64;
  }
  LODWORD(Protect) = 4;
  LODWORD(AllocationType) = 0x2000;
  VirtualMemory = ZwAllocateVirtualMemory(
                    (PVOID)0xFFFFFFFFFFFFFFFFi64,
                    &BaseAddress,
                    0i64,
                    &RegionSize,
                    AllocationType,
                    Protect);
  if( VirtualMemory >= 0 )
  {
LABEL_10:
    v8 = 0i64;
    if( a3[32] )
    {
      v9 = 0i64;
      do
      {
        LODWORD(Protect) = 4;
        LODWORD(AllocationType) = 0x2000;
        VirtualMemory = ZwAllocateVirtualMemory(
                          (PVOID)0xFFFFFFFFFFFFFFFFi64,
                          (PVOID *)(v9 + a3[35]),
                          0i64,
                          (UINT64 *)(v9 + a3[35] + 8),
                          AllocationType,
                          Protect);
        if( VirtualMemory < 0 )
          break;
        ++v8;
        v9 += 16i64;
      }
      while( v8 < a3[32] );
    }
  }
  KiUnstackDetachProcess(a2, 0i64);
  return(unsigned int)VirtualMemory;
}

Referenced by: